From c82f062d57c34357d2d18ff5cba875d318422034 Mon Sep 17 00:00:00 2001 From: gavrielc Date: Sat, 4 Jul 2026 16:11:09 +0300 Subject: [PATCH] Remove the dead data/env/env secrets mirror from setup Nothing has read data/env/env since commit 1a07869 removed the container mount, yet setup still wrote the full .env (live tokens included) there. Drop every writer and correct the stale comments/docs that described it. Co-Authored-By: Claude Opus 4.8 --- setup/add-discord.sh | 6 +----- setup/add-imessage.sh | 6 +----- setup/add-slack.sh | 6 +----- setup/add-teams.sh | 6 +----- setup/add-telegram.sh | 6 +----- setup/channels/signal.ts | 8 ++------ setup/channels/whatsapp.ts | 7 +------ setup/migrate-v2/channel-auth.ts | 9 --------- setup/migrate-v2/env.ts | 9 --------- setup/set-env.ts | 16 ++-------------- 10 files changed, 10 insertions(+), 69 deletions(-) diff --git a/setup/add-discord.sh b/setup/add-discord.sh index b9043d3a6..6ba063d68 100755 --- a/setup/add-discord.sh +++ b/setup/add-discord.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash # # Install the Discord adapter, persist DISCORD_BOT_TOKEN / APPLICATION_ID / -# PUBLIC_KEY to .env + data/env/env, and restart the service. Non-interactive — +# PUBLIC_KEY to .env, and restart the service. Non-interactive — # the operator-facing "Create a bot" walkthrough, owner confirmation, and # server-invite step live in setup/channels/discord.ts. Credentials come in via # env vars: DISCORD_BOT_TOKEN, DISCORD_APPLICATION_ID, DISCORD_PUBLIC_KEY. @@ -105,10 +105,6 @@ upsert_env DISCORD_BOT_TOKEN "$DISCORD_BOT_TOKEN" upsert_env DISCORD_APPLICATION_ID "$DISCORD_APPLICATION_ID" upsert_env DISCORD_PUBLIC_KEY "$DISCORD_PUBLIC_KEY" -# Container reads from data/env/env (the host mounts it). -mkdir -p data/env -cp .env data/env/env - log "Restarting service so the new adapter picks up the credentials…" # shellcheck source=setup/lib/install-slug.sh source "$PROJECT_ROOT/setup/lib/install-slug.sh" diff --git a/setup/add-imessage.sh b/setup/add-imessage.sh index ea1986203..c45ecf260 100755 --- a/setup/add-imessage.sh +++ b/setup/add-imessage.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # -# Install the iMessage adapter, persist mode/creds to .env + data/env/env, +# Install the iMessage adapter, persist mode/creds to .env, # and restart the service. Non-interactive — the Full Disk Access walkthrough # (local mode) and Photon URL/key prompts (remote mode) live in # setup/channels/imessage.ts. Creds come in via env vars: @@ -135,10 +135,6 @@ else remove_env IMESSAGE_ENABLED fi -# Container reads from data/env/env (the host mounts it). -mkdir -p data/env -cp .env data/env/env - log "Restarting service so the new adapter picks up the creds…" # shellcheck source=setup/lib/install-slug.sh source "$PROJECT_ROOT/setup/lib/install-slug.sh" diff --git a/setup/add-slack.sh b/setup/add-slack.sh index 23a9220d2..3aa63d757 100755 --- a/setup/add-slack.sh +++ b/setup/add-slack.sh @@ -2,7 +2,7 @@ # # Install the Slack adapter, persist SLACK_BOT_TOKEN plus the mode-specific # secret (SLACK_APP_TOKEN for Socket Mode, SLACK_SIGNING_SECRET for webhook) to -# .env + data/env/env, and restart the service. Non-interactive — the +# .env, and restart the service. Non-interactive — the # operator-facing app creation walkthrough + credential paste live in # setup/channels/slack.ts. Credentials come in via env vars: # SLACK_BOT_TOKEN, and SLACK_APP_TOKEN and/or SLACK_SIGNING_SECRET. @@ -108,10 +108,6 @@ if [ -n "${SLACK_SIGNING_SECRET:-}" ]; then upsert_env SLACK_SIGNING_SECRET "$SLACK_SIGNING_SECRET" fi -# Container reads from data/env/env (the host mounts it). -mkdir -p data/env -cp .env data/env/env - log "Restarting service so the new adapter picks up the credentials…" # shellcheck source=setup/lib/install-slug.sh source "$PROJECT_ROOT/setup/lib/install-slug.sh" diff --git a/setup/add-teams.sh b/setup/add-teams.sh index 58a99b3c1..7451926f5 100755 --- a/setup/add-teams.sh +++ b/setup/add-teams.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash # # Install the Teams adapter, persist TEAMS_APP_ID / _PASSWORD / _TENANT_ID / -# _TYPE to .env + data/env/env, and restart the service. Non-interactive — +# _TYPE to .env, and restart the service. Non-interactive — # the operator-facing Azure portal walkthroughs live in # setup/channels/teams.ts. Credentials come in via env vars: # TEAMS_APP_ID (required) @@ -114,10 +114,6 @@ if [ -n "${TEAMS_APP_TENANT_ID:-}" ]; then upsert_env TEAMS_APP_TENANT_ID "$TEAMS_APP_TENANT_ID" fi -# Container reads from data/env/env (the host mounts it). -mkdir -p data/env -cp .env data/env/env - log "Restarting service so the new adapter picks up the credentials…" # shellcheck source=setup/lib/install-slug.sh source "$PROJECT_ROOT/setup/lib/install-slug.sh" diff --git a/setup/add-telegram.sh b/setup/add-telegram.sh index 350764c27..ce8092047 100755 --- a/setup/add-telegram.sh +++ b/setup/add-telegram.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # -# Install the Telegram adapter, persist the bot token to .env + data/env/env, +# Install the Telegram adapter, persist the bot token to .env, # restart the service, and open the bot's chat page in the local Telegram # client. Non-interactive — the operator-facing "Create a bot" instructions # and token paste live in setup/auto.ts. The token comes in via the @@ -134,10 +134,6 @@ if echo "$INFO" | grep -q '"ok":true'; then BOT_USERNAME=$(echo "$INFO" | sed -nE 's/.*"username":"([^"]+)".*/\1/p') fi -# Container reads from data/env/env (the host mounts it). -mkdir -p data/env -cp .env data/env/env - # Browser/app deep-link is done by the parent driver (setup/channels/telegram.ts) # BEFORE this script runs — gated on a clack confirm so focus-stealing doesn't # surprise the user. Keeping it out of here means this script stays pure diff --git a/setup/channels/signal.ts b/setup/channels/signal.ts index cfdf9b297..818193b63 100644 --- a/setup/channels/signal.ts +++ b/setup/channels/signal.ts @@ -10,7 +10,7 @@ * 2. Install the adapter + qrcode via setup/add-signal.sh (idempotent). * 3. Run the signal-auth step, rendering each SIGNAL_AUTH_QR block as * a terminal QR the operator scans from Signal → Linked Devices. - * 4. Persist SIGNAL_ACCOUNT to .env (+ data/env/env). + * 4. Persist SIGNAL_ACCOUNT to .env. * 5. Kick the service so the adapter picks up the new credentials. * 6. Ask operator role + agent name. * 7. Wire the agent via scripts/init-first-agent.ts; the existing welcome @@ -333,7 +333,7 @@ async function renderQr(url: string): Promise { } } -/** Persist SIGNAL_ACCOUNT to .env and mirror to data/env/env for the container. */ +/** Persist SIGNAL_ACCOUNT to .env. */ function writeSignalAccount(account: string): void { const envPath = path.join(process.cwd(), '.env'); let contents = ''; @@ -353,10 +353,6 @@ function writeSignalAccount(account: string): void { } fs.writeFileSync(envPath, contents); - const containerEnvDir = path.join(process.cwd(), 'data', 'env'); - fs.mkdirSync(containerEnvDir, { recursive: true }); - fs.copyFileSync(envPath, path.join(containerEnvDir, 'env')); - setupLog.userInput('signal_account', account); } diff --git a/setup/channels/whatsapp.ts b/setup/channels/whatsapp.ts index b8365b4a5..75c006c57 100644 --- a/setup/channels/whatsapp.ts +++ b/setup/channels/whatsapp.ts @@ -433,7 +433,7 @@ async function askChatPhone(authedPhone: string): Promise { return phone; } -/** Persist ASSISTANT_HAS_OWN_NUMBER=true to .env and data/env/env. */ +/** Persist ASSISTANT_HAS_OWN_NUMBER=true to .env. */ function writeAssistantHasOwnNumber(): void { const envPath = path.join(process.cwd(), '.env'); let contents = ''; @@ -452,11 +452,6 @@ function writeAssistantHasOwnNumber(): void { contents += 'ASSISTANT_HAS_OWN_NUMBER=true\n'; } fs.writeFileSync(envPath, contents); - - // Container reads from data/env/env. - const containerEnvDir = path.join(process.cwd(), 'data', 'env'); - fs.mkdirSync(containerEnvDir, { recursive: true }); - fs.copyFileSync(envPath, path.join(containerEnvDir, 'env')); } async function resolveAgentName(): Promise { diff --git a/setup/migrate-v2/channel-auth.ts b/setup/migrate-v2/channel-auth.ts index 05d706de3..a280c36b8 100644 --- a/setup/migrate-v2/channel-auth.ts +++ b/setup/migrate-v2/channel-auth.ts @@ -116,15 +116,6 @@ function main(): void { channelsProcessed++; } - // Sync to data/env/env - if (fs.existsSync(v2EnvPath)) { - const containerEnvDir = path.join(process.cwd(), 'data', 'env'); - try { - fs.mkdirSync(containerEnvDir, { recursive: true }); - fs.copyFileSync(v2EnvPath, path.join(containerEnvDir, 'env')); - } catch { /* non-fatal */ } - } - console.log(`OK:channels=${channelsProcessed},env_keys=${envKeysCopied},files=${filesCopied}`); if (missing.length > 0) { console.log(`MISSING:${missing.join(',')}`); diff --git a/setup/migrate-v2/env.ts b/setup/migrate-v2/env.ts index 5ac52f621..80029ce22 100644 --- a/setup/migrate-v2/env.ts +++ b/setup/migrate-v2/env.ts @@ -65,15 +65,6 @@ function main(): void { fs.writeFileSync(v2EnvPath, result); } - // Sync to data/env/env (container reads from here) - const containerEnvDir = path.join(process.cwd(), 'data', 'env'); - try { - fs.mkdirSync(containerEnvDir, { recursive: true }); - fs.copyFileSync(v2EnvPath, path.join(containerEnvDir, 'env')); - } catch { - // Non-fatal - } - console.log(`OK:copied=${copied.length},skipped=${skipped.length}`); if (copied.length > 0) console.log(`COPIED:${copied.join(',')}`); } diff --git a/setup/set-env.ts b/setup/set-env.ts index 5ee4b4e84..d3e62a311 100644 --- a/setup/set-env.ts +++ b/setup/set-env.ts @@ -1,10 +1,9 @@ /** - * Step: set-env — Write or update a KEY=VALUE in .env, with optional sync to - * data/env/env (the container-mounted copy). + * Step: set-env — Write or update a KEY=VALUE in .env. * * Usage: * pnpm exec tsx setup/index.ts --step set-env -- \ - * --key TELEGRAM_BOT_TOKEN --value "" [--sync-container] + * --key TELEGRAM_BOT_TOKEN --value "" * * Exists so channel-install flows don't have to invent grep/sed/rm pipelines * (which can't be allowlisted tightly — sed can read any file, and each @@ -21,7 +20,6 @@ import { emitStatus } from './status.js'; export async function run(args: string[]): Promise { const keyIdx = args.indexOf('--key'); const valueIdx = args.indexOf('--value'); - const syncContainer = args.includes('--sync-container'); if (keyIdx === -1 || !args[keyIdx + 1]) { throw new Error('--key is required'); @@ -59,19 +57,9 @@ export async function run(args: string[]): Promise { fs.writeFileSync(envFile, content); log.info('Updated .env', { key, existed }); - let synced = false; - if (syncContainer) { - const dataEnvDir = path.join(projectRoot, 'data', 'env'); - fs.mkdirSync(dataEnvDir, { recursive: true }); - fs.copyFileSync(envFile, path.join(dataEnvDir, 'env')); - synced = true; - log.info('Synced .env to container mount', { path: 'data/env/env' }); - } - emitStatus('SET_ENV', { KEY: key, EXISTED: existed, - SYNCED_TO_CONTAINER: synced, STATUS: 'success', }); }